178eb0d9c156a755d4af7a96c42c4cb91f249ca0ed8a52c5484a098b8fe04e22

Analysis

user interaction
yes
max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 08:50

Target
roblox checker/__pycache__/Hotmail-Inboxer[V2].cpython-314.pyc
Size 80KB
Sample260531-krpreadt6w
SHA256 178eb0d9c156a755d4af7a96c42c4cb91f249ca0ed8a52c5484a098b8fe04e22
MD5 db923da856b8175bdaf105dffb1b68a2
SHA1 09196cc4859b93fe903ef1f4dbe4ea434b2c9762
SHA512 f697579d69f046a064ecc0d387474628c56bcc30f943239896aa8818564debba41cf8ccab085b88b27c28991d517f7dcd8687bed9af190410f72ace7d09fe121
SSDEEP 768:XDduW46du1E8f4Pfqg4VksWjYq3FWmMsNT2CyMbzvh1tBV4DFC8cq8g1bFSW:XDdF+fSfqjWjP1ZHnvh1tras8th1bUW
TLSH
T16D8339B489646027EED8F43C71E6E984E77296497100DB47F068ECEDBFCC32A964522D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\roblox checker\__pycache__\Hotmail-Inboxer[V2].cpython-314.pyc"
1⤵
- Modifies registry class
PID:1708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact